hhsetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
hhsetup.dll
Resource
win10v2004-20240426-en
General
-
Target
hhsetup.dll
-
Size
44KB
-
MD5
2d67bd42fd8314f91e150c47cab4c579
-
SHA1
a3e9fa2de6c00576d6b17565d3c7d48269557939
-
SHA256
038b6aaad136e12707f09628c640d7dd56f4403232ca23a88f864fdd5085ef3f
-
SHA512
f5c86c2ff301d29c7bcc0d5a2f4fb362e4d717a1af87f13b6999d119098c2767e7255859be779a6cf224ff5538b25593b4cab3e64525873f43ab3d01a3dd94b0
-
SSDEEP
768:4KM+dwcAGz7FCtI/SeGRBrXdz1IlCMLifrtmEmSPWvp1:4KM+d6Gzr/J4fzYL4kSPWx1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hhsetup.dll
Files
-
hhsetup.dll.dll windows:10 windows x86 arch:x86
582a32c786333f2960841a3643d5a98d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
feof
fgets
fclose
fopen
atoi
_splitpath
_vsnprintf
memset
kernel32
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetLastError
WriteFile
GetDriveTypeA
MultiByteToWideChar
CreateFileA
DeleteFileA
CloseHandle
WideCharToMultiByte
lstrcmpiA
IsDBCSLeadByte
GetCurrentProcess
GetShortPathNameW
GetLastError
GetFileAttributesA
GetCurrentThread
LoadLibraryA
GetVersionExA
LoadLibraryW
GetProcAddress
LocalFree
FreeLibrary
SetUnhandledExceptionFilter
ReadFile
SetFilePointer
GetFullPathNameA
GetFileTime
Sleep
UnhandledExceptionFilter
CreateDirectoryA
user32
CharPrevA
CharNextA
ole32
CoInitialize
CoUninitialize
CoGetClassObject
advapi32
RevertToSelf
RegCloseKey
AccessCheck
RegQueryValueExA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
ImpersonateSelf
OpenProcessToken
RegOpenKeyExA
InitializeAcl
MapGenericMask
OpenThreadToken
shlwapi
StrChrA
Exports
Exports
??0CCollection@@QAE@XZ
??0CFIFOString@@QAE@XZ
??0CFolder@@QAE@XZ
??0CLocation@@QAE@XZ
??0CPointerList@@QAE@XZ
??0CTitle@@QAE@XZ
??1CCollection@@QAE@XZ
??1CFIFOString@@QAE@XZ
??1CFolder@@QAE@XZ
??1CLocation@@QAE@XZ
??1CPointerList@@QAE@XZ
??1CTitle@@QAE@XZ
??4CCollection@@QAEAAV0@ABV0@@Z
??4CFIFOString@@QAEAAV0@ABV0@@Z
??4CFolder@@QAEAAV0@ABV0@@Z
??4CLocation@@QAEAAV0@ABV0@@Z
??4CPointerList@@QAEAAV0@ABV0@@Z
??4CTitle@@QAEAAV0@ABV0@@Z
?Add@CPointerList@@QAEPAUListItem@@PAX@Z
?AddChildFolder@CFolder@@QAEKPAV1@@Z
?AddChildFolder@CFolder@@QAEPAV1@PBDKPAKG@Z
?AddChildFolder@CFolder@@QAEPAV1@PBGKPAKG@Z
?AddCollection@CCollection@@QAEPAVCColList@@XZ
?AddFolder@CCollection@@QAEPAVCFolder@@PBDKPAKG@Z
?AddFolder@CCollection@@QAEPAVCFolder@@PBGKPAKG@Z
?AddLocation@CCollection@@QAEPAVCLocation@@PBD000PAK@Z
?AddLocation@CCollection@@QAEPAVCLocation@@PBG000PAK@Z
?AddLocationHistory@CTitle@@QAEKKPBD00PBVCLocation@@00H@Z
?AddLocationHistory@CTitle@@QAEKKPBG00PBVCLocation@@00H@Z
?AddRef@CCollection@@QAEXXZ
?AddRefedTitle@CCollection@@AAEKPAVCFolder@@@Z
?AddTail@CFIFOString@@QAEKPAD@Z
?AddTitle@CCollection@@QAEPAVCTitle@@PBD0000GIPAVCLocation@@PAKH0@Z
?AddTitle@CCollection@@QAEPAVCTitle@@PBG0000GIPAVCLocation@@PAKH0@Z
?AllocCopyValue@CCollection@@AAEKPAVCParseXML@@PADPAPAD@Z
?AllocSetValue@@YGKPBDPAPAD@Z
?CheckTitleRef@CCollection@@AAEKPBDG@Z
?CheckTitleRef@CCollection@@AAEKPBGG@Z
?Close@CCollection@@QAEKXZ
?ConfirmTitles@CCollection@@QAEXXZ
?DecrementRefTitleCount@CCollection@@QAEXXZ
?DeleteChildren@CCollection@@AAEXPAPAVCFolder@@@Z
?DeleteFolder@CCollection@@QAEKPAVCFolder@@@Z
?DeleteFolders@CCollection@@AAEXPAPAVCFolder@@@Z
?DeleteLocalFiles@CCollection@@AAEXPAULocationHistory@@PAVCTitle@@@Z
?DeleteLocation@CCollection@@AAEKPAVCLocation@@@Z
?DeleteTitle@CCollection@@AAEKPAVCTitle@@@Z
?Dirty@CCollection@@QAEXXZ
?FindCollection@CCollection@@QAEPAVCColList@@PBD@Z
?FindLocation@CCollection@@QAEPAVCLocation@@PBDPAI@Z
?FindLocation@CCollection@@QAEPAVCLocation@@PBGPAI@Z
?FindTitle@CCollection@@QAEPAVCTitle@@PBDG@Z
?FindTitle@CCollection@@QAEPAVCTitle@@PBGG@Z
?First@CPointerList@@QAEPAUListItem@@XZ
?FirstLocation@CCollection@@QAEPAVCLocation@@XZ
?GetColNo@CCollection@@QAEKXZ
?GetCollectionFileName@CCollection@@QAEPBDXZ
?GetCollectionFileNameW@CCollection@@QAEPBGXZ
?GetFindMergedCHMS@CCollection@@QAEHXZ
?GetFirstChildFolder@CFolder@@QAEPAV1@XZ
?GetFirstTitle@CCollection@@QAEPAVCTitle@@XZ
?GetId@CLocation@@QBEPADXZ
?GetId@CTitle@@QAEPADXZ
?GetIdW@CLocation@@QAEPBGXZ
?GetIdW@CTitle@@QAEPBGXZ
?GetLangId@CCollection@@QAEGPBD@Z
?GetLangId@CCollection@@QAEGPBG@Z
?GetLanguage@CFolder@@QAEGXZ
?GetLanguage@CTitle@@QAEGXZ
?GetLocation@CTitle@@QAEPAULocationHistory@@K@Z
?GetMasterCHM@CCollection@@QAEHPAPADPAG@Z
?GetMasterCHM@CCollection@@QAEHPAPAGPAG@Z
?GetNextFolder@CFolder@@QAEPAV1@XZ
?GetNextLocation@CLocation@@QAEPAV1@XZ
?GetNextTitle@CTitle@@QAEPAV1@XZ
?GetOrder@CFolder@@QAEKXZ
?GetParent@CFolder@@QAEPAV1@XZ
?GetPath@CLocation@@QAEPADXZ
?GetPathW@CLocation@@QAEPBGXZ
?GetRefTitleCount@CCollection@@QAEKXZ
?GetRootFolder@CCollection@@QAEPAVCFolder@@XZ
?GetSampleLocation@CCollection@@QAEPADXZ
?GetSampleLocationW@CCollection@@QAEPBGXZ
?GetTail@CFIFOString@@QAEKPAPAD@Z
?GetTitle@CFolder@@QAEPADXZ
?GetTitle@CLocation@@QAEPADXZ
?GetTitleW@CFolder@@QAEPBGXZ
?GetTitleW@CLocation@@QAEPBGXZ
?GetVersion@CCollection@@QAEKXZ
?GetVisableRootFolder@CCollection@@QAEPAVCFolder@@XZ
?GetVolume@CLocation@@QAEPADXZ
?GetVolumeW@CLocation@@QAEPBGXZ
?HandleCollection@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleCollectionEntry@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleFolder@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleLocation@CCollection@@AAEKPAVCParseXML@@PAD@Z
?HandleTitle@CCollection@@AAEKPAVCParseXML@@PAD@Z
?IncrementRefTitleCount@CCollection@@QAEXXZ
?IsDirty@CCollection@@QAEHXZ
?MergeKeywords@CCollection@@QAEHPAD@Z
?MergeKeywords@CCollection@@QAEHPAG@Z
?NewLocation@CCollection@@AAEPAVCLocation@@XZ
?NewLocationHistory@CTitle@@QAEPAULocationHistory@@XZ
?NewTitle@CCollection@@AAEPAVCTitle@@XZ
?Next@CPointerList@@QAEPAUListItem@@PAU2@@Z
?Open@CCollection@@QAEKPBD@Z
?Open@CCollection@@QAEKPBG@Z
?ParseFile@CCollection@@AAEKPBD@Z
?Release@CCollection@@AAEKXZ
?RemoveAll@CFIFOString@@QAEXXZ
?RemoveAll@CPointerList@@QAEXXZ
?RemoveCollection@CCollection@@QAEKH@Z
?RemoveCollectionEntry@CCollection@@QAEXPBD@Z
?Save@CCollection@@QAEKXZ
?SetExTitlePtr@CFolder@@QAEXPAVCExTitle@@@Z
?SetFindMergedCHMS@CCollection@@QAEXH@Z
?SetFirstChildFolder@CFolder@@QAEXPAV1@@Z
?SetId@CLocation@@QAEXPBD@Z
?SetId@CLocation@@QAEXPBG@Z
?SetId@CTitle@@QAEXPBD@Z
?SetId@CTitle@@QAEXPBG@Z
?SetLanguage@CFolder@@QAEXG@Z
?SetLanguage@CTitle@@QAEXG@Z
?SetMasterCHM@CCollection@@QAEXPBDG@Z
?SetMasterCHM@CCollection@@QAEXPBGG@Z
?SetNextFolder@CFolder@@QAEXPAV1@@Z
?SetNextLocation@CLocation@@QAEXPAV1@@Z
?SetNextTitle@CTitle@@QAEXPAV1@@Z
?SetOrder@CFolder@@QAEXK@Z
?SetParent@CFolder@@QAEXPAV1@@Z
?SetPath@CLocation@@QAEXPBD@Z
?SetPath@CLocation@@QAEXPBG@Z
?SetSampleLocation@CCollection@@QAEXPBD@Z
?SetSampleLocation@CCollection@@QAEXPBG@Z
?SetTitle@CFolder@@QAEXPBD@Z
?SetTitle@CFolder@@QAEXPBG@Z
?SetTitle@CLocation@@QAEXPBD@Z
?SetTitle@CLocation@@QAEXPBG@Z
?SetVersion@CCollection@@QAEXK@Z
?SetVolume@CLocation@@QAEXPBD@Z
?SetVolume@CLocation@@QAEXPBG@Z
?WriteFolder@CCollection@@AAEHPAPAVCFolder@@@Z
?WriteFolders@CCollection@@AAEHPAPAVCFolder@@@Z
?bIsVisable@CFolder@@QAEHXZ
?wssResetNextColNum@CCollection@@AAEXXZ
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ